[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Spanning tree Portfast Bpdugard

Posted on 2016-07-17
15
Medium Priority
?
107 Views
Last Modified: 2016-07-22
I am trying to see the difference in configuring Bpdugard Globally and on specific interfaces
- when  configured On specific Interfaces when it receives superior BPDU the interface will go to err-disable status
-when configured Globally, I do not see any difference, I mean NO  ports go to err-disable status.

Any clarification on BPDGUARD when configured globally ?

Thank you
0
Comment
Question by:jskfan
  • 9
  • 2
  • 2
  • +2
15 Comments
 
LVL 11

Assisted Solution

by:Richardson Porto
Richardson Porto earned 132 total points
ID: 41716075
You can enable or disable STP PortFast BPDU guard on a global basis, which affects all ports that have PortFast configured.

Source: http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10586-65.html#topic3
0
 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 132 total points
ID: 41716107
The global BPDUguard and BPDUfilter command only apply to ports which are configured with portfast.
0
 

Author Comment

by:jskfan
ID: 41716197
I did configure on Switch 1 globally spanning tree portfast default  and spanning portfast Bpdugard default

on SW2 I shut down the connected interfaces to Switch 1,   then brought them back up with No Shutdown.
However nothing happen on Switch1. I mean I do not see the ERR-DISABLE  keyword.

Per Port configuration:
I  configured the same thing on Interfaces I get the ERR_DIsable when Switch2 interfaces come back up, but Globally I have not seen that happened.
0
NFR key for Veeam Agent for Linux

Veeam is happy to provide a free NFR license for one year.  It allows for the non‑production use and valid for five workstations and two servers. Veeam Agent for Linux is a simple backup tool for your Linux installations, both on‑premises and in the public cloud.

 
LVL 50

Expert Comment

by:Don Johnston
ID: 41716215
First... Are these real switches or packet tracer or GNS?

If they aren't actual, physical switches, we're done. The simulators and emulators have too many inconsistencies.

Second, if we're talking about actual switches, please post the configs and specify which ports are relevant.
0
 
LVL 9

Expert Comment

by:Ian Arakel
ID: 41717020
Hi there,

There is no difference in functionality of BPDU guard when configured globally or per interface basis.
The transitioning of the port into err-disabled once a BPDU is received on the BPDU guard enabled is the same in both cases.
0
 
LVL 31

Assisted Solution

by:Predrag
Predrag earned 136 total points
ID: 41717585
Note:
- when  configured On specific Interfaces when it receives superior BPDU the interface will go to err-disable status
This is not function of BPDUguard.
BPDU guard puts port into err-disabled state as soon as it receives any BDPU on interface.
Root Guard is the one that matches that description - when superior BDPU is received will place port in root-inconsistent state.
0
 

Author Comment

by:jskfan
ID: 41718058
SW1#sh run
Building configuration...

Current configuration : 1129 bytes
!
! Last configuration change at 01:46:10 CET Tue Jul 19 2016
!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname SW1
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
clock timezone CET 1 0
no ipv6 cef
ipv6 multicast rpf use-bgp
!
ip cef
!
!
!
!
!
spanning-tree mode rapid-pvst
spanning-tree portfast default
spanning-tree portfast bpduguard default
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
 duplex auto
!
interface Ethernet0/1
 duplex auto
!
interface Ethernet0/2
 duplex auto
!
interface Ethernet0/3
 duplex auto
!
interface Ethernet1/0
 duplex auto
!
interface Ethernet1/1
 duplex auto
!
interface Ethernet1/2
 duplex auto
!
interface Ethernet1/3
 duplex auto
!
interface Ethernet2/0
 duplex auto
!
interface Ethernet2/1
 duplex auto
!
interface Ethernet2/2
 duplex auto
!
interface Ethernet2/3
 duplex auto
!
!
no ip http server
!
!
!
!
!
control-plane
!
!
line con 0
 logging synchronous
line aux 0
line vty 0 4
 login
!
end

Open in new window



SW2#sh run
Building configuration...

Current configuration : 1117 bytes
!
! Last configuration change at 01:43:05 CET Tue Jul 19 2016
!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname SW2
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
clock timezone CET 1 0
no ipv6 cef
ipv6 multicast rpf use-bgp
!
ip cef
!
!
!
!
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
 duplex auto
!
interface Ethernet0/1
 shutdown
 duplex auto
!
interface Ethernet0/2
 shutdown
 duplex auto
!
interface Ethernet0/3
 shutdown
 duplex auto
!
interface Ethernet1/0
 duplex auto
!
interface Ethernet1/1
 duplex auto
!
interface Ethernet1/2
 duplex auto
!
interface Ethernet1/3
 duplex auto
!
interface Ethernet2/0
 shutdown
 duplex auto
!
interface Ethernet2/1
 shutdown
 duplex auto
!
interface Ethernet2/2
 duplex auto
!
interface Ethernet2/3
 shutdown
 duplex auto
!
!
no ip http server
!
!
!
!
!
control-plane
!
!
line con 0
 logging synchronous
line aux 0
line vty 0 4
 login
!
end

Open in new window

STP.JPG
0
 

Author Comment

by:jskfan
ID: 41718060
As shown in the attached file, on SW2 I shut down e0/0 and e2/2 then brings them back up
the e2/2 on SW1 will go through LIST/LRN/FWD
but does not go to Err-Disable state
0
 

Author Comment

by:jskfan
ID: 41718061
stp
0
 

Author Comment

by:jskfan
ID: 41718068
SW1#sh span

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    32769
             Address     aabb.cc00.0100
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     aabb.cc00.0100
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Et0/0               Desg FWD 100       128.1    Shr
Et0/1               Desg FWD 100       128.2    Shr Edge
Et0/2               Desg FWD 100       128.3    Shr Edge
Et0/3               Desg FWD 100       128.4    Shr Edge
Et1/0               Desg FWD 100       128.5    Shr Edge
Et1/1               Desg FWD 100       128.6    Shr Edge
Et1/2               Desg FWD 100       128.7    Shr Edge
Et1/3               Desg FWD 100       128.8    Shr Edge

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------

Et2/0               Desg FWD 100       128.9    Shr Edge
Et2/1               Desg FWD 100       128.10   Shr Edge
Et2/2               Desg FWD 100       128.11   Shr
Et2/3               Desg FWD 100       128.12   Shr Edge

Open in new window


SW1#sh interfaces statu

Port      Name               Status       Vlan       Duplex  Speed Type
Et0/0                        connected    trunk        auto   auto unknown
Et0/1                        connected    1            auto   auto unknown
Et0/2                        connected    1            auto   auto unknown
Et0/3                        connected    1            auto   auto unknown
Et1/0                        connected    1            auto   auto unknown
Et1/1                        connected    1            auto   auto unknown
Et1/2                        connected    1            auto   auto unknown
Et1/3                        connected    1            auto   auto unknown
Et2/0                        connected    1            auto   auto unknown
Et2/1                        connected    1            auto   auto unknown
Et2/2                        connected    trunk        auto   auto unknown
Et2/3                        connected    1            auto   auto unknown
SW1#

Open in new window

0
 
LVL 9

Accepted Solution

by:
Ian Arakel earned 1600 total points
ID: 41718156
Hi there,

This behavior is observed since you have not configured the e2/2 and e0/0 as access ports.
The ports assume a trunk role by default as per my understanding

Below is fact as per the Cisco documentation:

PortFast BPDU guard prevents loops by moving a nontrunking port into an errdisable state when a BPDU is received on that port. When you enable BPDU guard on the switch, spanning tree shuts down PortFast-configured interfaces that receive BPDUs instead of putting them into the spanning tree blocking state
0
 

Author Comment

by:jskfan
ID: 41719071
This behavior is observed since you have not configured the e2/2 and e0/0 as access ports.
The ports assume a trunk role by default as per my understanding

I thought about that last night after I watched youtube video.
I will try it later
0
 

Author Comment

by:jskfan
ID: 41719072
Thank you
0
 

Author Comment

by:jskfan
ID: 41719075
However when I configured BPDUGUARD by Port instead Gloabal...even the ports were Trunk...one of them still went to Err-Disable status
0
 

Author Comment

by:jskfan
ID: 41720064
These are the Findings:
BPDUGUARD (GLOBAL)

LAB example:
on SW2= Shutdown the Port Connecting to SW1

On SW1:
First the Port(s)  facing the Devices that are not supposed to Send BPDUs ; such as computers need to be configured as Access Ports.
Then at the global configuration of the Switch facing the computers, configure with both commands below:

SW1(config)#spanning-tree portfast default
SW1(config)#spanning-tree portfast bpduguard default

on SW2= Type No Shutdown on the Port Connecting to SW1, This will send BPDUs to the access port on SW1 and the port will go into Err-Disable State.
===================================

Per Port

I did not have to configure any port linking SW1 to SW2 as access port , I left them as Trunk
Lab Example
ON SW2: I shutdown the trunk port linking to SW1
On SW1 :
SW1(config-if)#spanning-tree bpduguard enable

Then on SW2, I type No Shutdown on the Trunk port
SW1 port went into err-disable state.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Getting hacked is no longer a matter or "if you get hacked" — the 2016 cyber threat landscape is now titled "when you get hacked." When it happens — will you be proactive, or reactive?
Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
Viewers will learn how to properly install and use Secure Shell (SSH) to work on projects or homework remotely. Download Secure Shell: Follow basic installation instructions: Open Secure Shell and use "Quick Connect" to enter credentials includi…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…

872 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question